History

jbd2: fix potential double free

When failing from creating cache jbd2_inode_cache, we will destroy the previously created cache jbd2_handle_cache twice. This patch fixes this by moving each cache initialization/destruction to its own separate, individual function.

Chengguang Xu committed 7 years ago

Commit 0d521541 parent 592acbf4 files · +61 −36Browse files

Unified · Split

4 files
  1. fs/jbd2/journal.c +31 −18
  2. fs/jbd2/revoke.c +20 −12
  3. fs/jbd2/transaction.c +5 −3
  4. include/linux/jbd2.h +5 −3
fs/jbd2/journal.c+31−18
@@ -2375,22 +2375,19 @@ static struct kmem_cache *jbd2_journal_head_cache; · 2374 unmodified lines
23752375 static atomic_t nr_journal_heads = ATOMIC_INIT(0);
23762376 #endif
23772377
2378−static int jbd2_journal_init_journal_head_cache(void)
2378+static int __init jbd2_journal_init_journal_head_cache(void)
23792379 {
2380− int retval;
2381−
2382− J_ASSERT(jbd2_journal_head_cache == NULL);
2380+ J_ASSERT(!jbd2_journal_head_cache);
23832381 jbd2_journal_head_cache = kmem_cache_create("jbd2_journal_head",
23842382 sizeof(struct journal_head),
23852383 0, /* offset */
23862384 SLAB_TEMPORARY | SLAB_TYPESAFE_BY_RCU,
23872385 NULL); /* ctor */
2388− retval = 0;
23892386 if (!jbd2_journal_head_cache) {
2390− retval = -ENOMEM;
23912387 printk(KERN_EMERG "JBD2: no memory for journal_head cache\n");
2388+ return -ENOMEM;
23922389 }
2393− return retval;
2390+ return 0;
23942391 }
23952392
23962393 static void jbd2_journal_destroy_journal_head_cache(void)
@@ -2636,28 +2633,38 @@ static void __exit jbd2_remove_jbd_stats_proc_entry(void) · 239 unmodified lines
26362633
26372634 struct kmem_cache *jbd2_handle_cache, *jbd2_inode_cache;
26382635
2636+static int __init jbd2_journal_init_inode_cache(void)
2637+{
2638+ J_ASSERT(!jbd2_inode_cache);
2639+ jbd2_inode_cache = KMEM_CACHE(jbd2_inode, 0);
2640+ if (!jbd2_inode_cache) {
2641+ pr_emerg("JBD2: failed to create inode cache\n");
2642+ return -ENOMEM;
2643+ }
2644+ return 0;
2645+}
2646+
26392647 static int __init jbd2_journal_init_handle_cache(void)
26402648 {
2649+ J_ASSERT(!jbd2_handle_cache);
26412650 jbd2_handle_cache = KMEM_CACHE(jbd2_journal_handle, SLAB_TEMPORARY);
2642− if (jbd2_handle_cache == NULL) {
2651+ if (!jbd2_handle_cache) {
26432652 printk(KERN_EMERG "JBD2: failed to create handle cache\n");
26442653 return -ENOMEM;
26452654 }
2646− jbd2_inode_cache = KMEM_CACHE(jbd2_inode, 0);
2647− if (jbd2_inode_cache == NULL) {
2648− printk(KERN_EMERG "JBD2: failed to create inode cache\n");
2649− kmem_cache_destroy(jbd2_handle_cache);
2650− return -ENOMEM;
2651− }
26522655 return 0;
26532656 }
26542657
2658+static void jbd2_journal_destroy_inode_cache(void)
2659+{
2660+ kmem_cache_destroy(jbd2_inode_cache);
2661+ jbd2_inode_cache = NULL;
2662+}
2663+
26552664 static void jbd2_journal_destroy_handle_cache(void)
26562665 {
26572666 kmem_cache_destroy(jbd2_handle_cache);
26582667 jbd2_handle_cache = NULL;
2659− kmem_cache_destroy(jbd2_inode_cache);
2660− jbd2_inode_cache = NULL;
26612668 }
26622669
26632670 /*
@@ -2668,11 +2675,15 @@ static int __init journal_init_caches(void) · 4 unmodified lines
26682675 {
26692676 int ret;
26702677
2671− ret = jbd2_journal_init_revoke_caches();
2678+ ret = jbd2_journal_init_revoke_record_cache();
2679+ if (ret == 0)
2680+ ret = jbd2_journal_init_revoke_table_cache();
26722681 if (ret == 0)
26732682 ret = jbd2_journal_init_journal_head_cache();
26742683 if (ret == 0)
26752684 ret = jbd2_journal_init_handle_cache();
2685+ if (ret == 0)
2686+ ret = jbd2_journal_init_inode_cache();
26762687 if (ret == 0)
26772688 ret = jbd2_journal_init_transaction_cache();
26782689 return ret;
@@ -2680,9 +2691,11 @@ static int __init journal_init_caches(void) · 1 unmodified line
26802691
26812692 static void jbd2_journal_destroy_caches(void)
26822693 {
2683− jbd2_journal_destroy_revoke_caches();
2694+ jbd2_journal_destroy_revoke_record_cache();
2695+ jbd2_journal_destroy_revoke_table_cache();
26842696 jbd2_journal_destroy_journal_head_cache();
26852697 jbd2_journal_destroy_handle_cache();
2698+ jbd2_journal_destroy_inode_cache();
26862699 jbd2_journal_destroy_transaction_cache();
26872700 jbd2_journal_destroy_slabs();
26882701 }
fs/jbd2/revoke.c+20−12
@@ -178,33 +178,41 @@ static struct jbd2_revoke_record_s *find_revoke_record(journal_t *journal, · 177 unmodified lines
178178 return NULL;
179179 }
180180
181−void jbd2_journal_destroy_revoke_caches(void)
181+void jbd2_journal_destroy_revoke_record_cache(void)
182182 {
183183 kmem_cache_destroy(jbd2_revoke_record_cache);
184184 jbd2_revoke_record_cache = NULL;
185+}
186+
187+void jbd2_journal_destroy_revoke_table_cache(void)
188+{
185189 kmem_cache_destroy(jbd2_revoke_table_cache);
186190 jbd2_revoke_table_cache = NULL;
187191 }
188192
189−int __init jbd2_journal_init_revoke_caches(void)
193+int __init jbd2_journal_init_revoke_record_cache(void)
190194 {
191195 J_ASSERT(!jbd2_revoke_record_cache);
192− J_ASSERT(!jbd2_revoke_table_cache);
193−
194196 jbd2_revoke_record_cache = KMEM_CACHE(jbd2_revoke_record_s,
195197 SLAB_HWCACHE_ALIGN|SLAB_TEMPORARY);
196− if (!jbd2_revoke_record_cache)
197− goto record_cache_failure;
198198
199+ if (!jbd2_revoke_record_cache) {
200+ pr_emerg("JBD2: failed to create revoke_record cache\n");
201+ return -ENOMEM;
202+ }
203+ return 0;
204+}
205+
206+int __init jbd2_journal_init_revoke_table_cache(void)
207+{
208+ J_ASSERT(!jbd2_revoke_table_cache);
199209 jbd2_revoke_table_cache = KMEM_CACHE(jbd2_revoke_table_s,
200210 SLAB_TEMPORARY);
201− if (!jbd2_revoke_table_cache)
202− goto table_cache_failure;
203− return 0;
204−table_cache_failure:
205− jbd2_journal_destroy_revoke_caches();
206−record_cache_failure:
211+ if (!jbd2_revoke_table_cache) {
212+ pr_emerg("JBD2: failed to create revoke_table cache\n");
207213 return -ENOMEM;
214+ }
215+ return 0;
208216 }
209217
210218 static struct jbd2_revoke_table_s *jbd2_journal_init_revoke_table(int hash_size)
fs/jbd2/transaction.c+5−3
@@ -42,9 +42,11 @@ int __init jbd2_journal_init_transaction_cache(void) · 41 unmodified lines
4242 0,
4343 SLAB_HWCACHE_ALIGN|SLAB_TEMPORARY,
4444 NULL);
45− if (transaction_cache)
46− return 0;
47− return -ENOMEM;
45+ if (!transaction_cache) {
46+ pr_emerg("JBD2: failed to create transaction cache\n");
47+ return -ENOMEM;
48+ }
49+ return 0;
4850 }
4951
5052 void jbd2_journal_destroy_transaction_cache(void)
include/linux/jbd2.h+5−3
@@ -1318,7 +1318,7 @@ extern void __wait_on_journal (journal_t *); · 1317 unmodified lines
13181318
13191319 /* Transaction cache support */
13201320 extern void jbd2_journal_destroy_transaction_cache(void);
1321−extern int jbd2_journal_init_transaction_cache(void);
1321+extern int __init jbd2_journal_init_transaction_cache(void);
13221322 extern void jbd2_journal_free_transaction(transaction_t *);
13231323
13241324 /*
@@ -1446,8 +1446,10 @@ static inline void jbd2_free_inode(struct jbd2_inode *jinode) · 121 unmodified lines
14461446 /* Primary revoke support */
14471447 #define JOURNAL_REVOKE_DEFAULT_HASH 256
14481448 extern int jbd2_journal_init_revoke(journal_t *, int);
1449−extern void jbd2_journal_destroy_revoke_caches(void);
1450−extern int jbd2_journal_init_revoke_caches(void);
1449+extern void jbd2_journal_destroy_revoke_record_cache(void);
1450+extern void jbd2_journal_destroy_revoke_table_cache(void);
1451+extern int __init jbd2_journal_init_revoke_record_cache(void);
1452+extern int __init jbd2_journal_init_revoke_table_cache(void);
14511453
14521454 extern void jbd2_journal_destroy_revoke(journal_t *);
14531455 extern int jbd2_journal_revoke (handle_t *, unsigned long long, struct buffer_head *);

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t